diff --git a/packages/library/cozy-lib/templates/_tls.tpl b/packages/library/cozy-lib/templates/_tls.tpl
index 13a80cf8..310ccfbb 100644
--- a/packages/library/cozy-lib/templates/_tls.tpl
+++ b/packages/library/cozy-lib/templates/_tls.tpl
@@ -22,7 +22,7 @@ Parameters:
   - dnsNames   (required) - list of DNS SANs
   - issuerRef  (required) - dict with "name" and "kind" (e.g. ClusterIssuer, Issuer)
   - duration   (optional) - certificate duration, defaults to 8760h (1 year); empty strings are treated as unset
-  - renewBefore(optional) - renewal window, defaults to 720h (30 days)
+  - renewBefore (optional) - renewal window, defaults to 720h (30 days)
   - usages     (optional) - list of key usages, defaults to ["server auth"] (not cert-manager's default of "digital signature, key encipherment"; this is a deliberate choice for TLS server certificates)
 */}}
 {{- define "cozy-lib.tls.certificate" -}}
@@ -96,6 +96,12 @@ Parameters:
   - secretName (optional) - user-provided secret name; if set, returned as-is
 */}}
 {{- define "cozy-lib.tls.secretName" -}}
+{{- if not .Release -}}
+{{-   fail "ERROR: \"Release\" is required for cozy-lib.tls.secretName. Pass the Helm release object via the context dict." -}}
+{{- end -}}
+{{- if not .suffix -}}
+{{-   fail "ERROR: \"suffix\" is required for cozy-lib.tls.secretName. Provide a suffix for the generated secret name (e.g. \"tls\", \"server-tls\")." -}}
+{{- end -}}
 {{- if not (empty .secretName) -}}
 {{-   .secretName -}}
 {{- else -}}
diff --git a/packages/tests/cozy-lib-tests/templates/tests/tls-secretname-missing-release.yaml b/packages/tests/cozy-lib-tests/templates/tests/tls-secretname-missing-release.yaml
new file mode 100644
index 00000000..b361c611
--- /dev/null
+++ b/packages/tests/cozy-lib-tests/templates/tests/tls-secretname-missing-release.yaml
@@ -0,0 +1,11 @@
+{{/*
+Test-only template: calls cozy-lib.tls.secretName without Release
+to verify the validation guard triggers.
+*/}}
+{{- $secretName := include "cozy-lib.tls.secretName" (dict "suffix" "tls" "secretName" .Values.tlsSecretName) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-secretname-missing-release
+data:
+  secretName: {{ $secretName | quote }}
diff --git a/packages/tests/cozy-lib-tests/templates/tests/tls-secretname-missing-suffix.yaml b/packages/tests/cozy-lib-tests/templates/tests/tls-secretname-missing-suffix.yaml
new file mode 100644
index 00000000..199d7d6d
--- /dev/null
+++ b/packages/tests/cozy-lib-tests/templates/tests/tls-secretname-missing-suffix.yaml
@@ -0,0 +1,11 @@
+{{/*
+Test-only template: calls cozy-lib.tls.secretName without suffix
+to verify the validation guard triggers.
+*/}}
+{{- $secretName := include "cozy-lib.tls.secretName" (dict "Release" .Release "secretName" .Values.tlsSecretName) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-secretname-missing-suffix
+data:
+  secretName: {{ $secretName | quote }}
diff --git a/packages/tests/cozy-lib-tests/tests/tls_secretname_missing_release_test.yaml b/packages/tests/cozy-lib-tests/tests/tls_secretname_missing_release_test.yaml
new file mode 100644
index 00000000..ecfcb9ea
--- /dev/null
+++ b/packages/tests/cozy-lib-tests/tests/tls_secretname_missing_release_test.yaml
@@ -0,0 +1,17 @@
+suite: TLS secretName helper - Release validation
+
+templates:
+  - templates/tests/tls-secretname-missing-release.yaml
+
+tests:
+  - it: errors when Release is not provided
+    release:
+      name: my-app
+      namespace: tenant-test
+    set:
+      _cluster: {}
+      _namespace: {}
+      tlsSecretName: my-custom-tls-secret
+    asserts:
+      - failedTemplate:
+          errorMessage: 'ERROR: "Release" is required for cozy-lib.tls.secretName. Pass the Helm release object via the context dict.'
diff --git a/packages/tests/cozy-lib-tests/tests/tls_secretname_missing_suffix_test.yaml b/packages/tests/cozy-lib-tests/tests/tls_secretname_missing_suffix_test.yaml
new file mode 100644
index 00000000..586d0cee
--- /dev/null
+++ b/packages/tests/cozy-lib-tests/tests/tls_secretname_missing_suffix_test.yaml
@@ -0,0 +1,17 @@
+suite: TLS secretName helper - suffix validation
+
+templates:
+  - templates/tests/tls-secretname-missing-suffix.yaml
+
+tests:
+  - it: errors when suffix is not provided
+    release:
+      name: my-app
+      namespace: tenant-test
+    set:
+      _cluster: {}
+      _namespace: {}
+      tlsSecretName: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: 'ERROR: "suffix" is required for cozy-lib.tls.secretName. Provide a suffix for the generated secret name (e.g. "tls", "server-tls").'